https://community.splunk.com/t5/Splunk-Search/Issue-with-field-extraction-regex/m-p/472875#M140457 <P>Hello plp,</P> <P>I have this problem, i need to extract 2 fields of this event.</P> <P>[14/04/2020 16:17:49][INFO][http-8080-36][ar.xxx.xxx.xx]:116 - (3;;57AF476E9DDAF14CA60BA1E589C55CF8) Usuario: UserName Operador: OperadorName EstadoOperadorToken: Token Activo</P> <P>i need a regex that capture the string after "Usuario" and "Operador"</P> <P>Any one can help me_</P> Mon, 08 Jun 2020 04:23:49 GMT tinpelayee 2020-06-08T04:23:49Z https://community.splunk.com/t5/Splunk-Search/Issue-with-field-extraction-regex/m-p/472875#M140457 <P>Hello plp,</P> <P>I have this problem, i need to extract 2 fields of this event.</P> <P>[14/04/2020 16:17:49][INFO][http-8080-36][ar.xxx.xxx.xx]:116 - (3;;57AF476E9DDAF14CA60BA1E589C55CF8) Usuario: UserName Operador: OperadorName EstadoOperadorToken: Token Activo</P> <P>i need a regex that capture the string after "Usuario" and "Operador"</P> <P>Any one can help me_</P> Mon, 08 Jun 2020 04:23:49 GMT https://community.splunk.com/t5/Splunk-Search/Issue-with-field-extraction-regex/m-p/472875#M140457 tinpelayee 2020-06-08T04:23:49Z https://community.splunk.com/t5/Splunk-Search/Issue-with-field-extraction-regex/m-p/472876#M140458 <PRE><CODE>| rex "Usuario:\s(?&lt;UserName&gt;[\S]+)\sOperador:\s(?&lt;OperadorName&gt;[\S]+)" </CODE></PRE> Wed, 15 Apr 2020 16:36:47 GMT https://community.splunk.com/t5/Splunk-Search/Issue-with-field-extraction-regex/m-p/472876#M140458 jpolvino 2020-04-15T16:36:47Z